https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-59851.htmlhttps://patchthecve.com/cve/CVE-2026-59851.htmlMon, 17 Aug 2026 22:17:15 +0000HIGH 8.8: A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.https://patchthecve.com/cve/CVE-2026-59850.htmlhttps://patchthecve.com/cve/CVE-2026-59850.htmlTue, 01 Sep 2026 21:18:35 +0000MEDIUM 4.3: A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.https://patchthecve.com/cve/CVE-2026-59849.htmlhttps://patchthecve.com/cve/CVE-2026-59849.htmlTue, 22 Sep 2026 19:48:05 +0000LOW 3.1: A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.https://patchthecve.com/cve/CVE-2026-59848.htmlhttps://patchthecve.com/cve/CVE-2026-59848.htmlTue, 01 Sep 2026 21:18:35 +0000MEDIUM 5.3: A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.https://patchthecve.com/cve/CVE-2026-59847.htmlhttps://patchthecve.com/cve/CVE-2026-59847.htmlFri, 04 Sep 2026 19:23:04 +0000MEDIUM 5.9: A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.https://patchthecve.com/cve/CVE-2026-59846.htmlhttps://patchthecve.com/cve/CVE-2026-59846.htmlTue, 01 Sep 2026 21:18:34 +0000LOW 3.9: A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.https://patchthecve.com/cve/CVE-2026-59845.htmlhttps://patchthecve.com/cve/CVE-2026-59845.htmlTue, 01 Sep 2026 21:18:34 +0000MEDIUM 5.3: A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.https://patchthecve.com/cve/CVE-2026-59844.htmlhttps://patchthecve.com/cve/CVE-2026-59844.htmlTue, 01 Sep 2026 21:18:34 +0000MEDIUM 6.5: A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.https://patchthecve.com/cve/CVE-2026-59843.htmlhttps://patchthecve.com/cve/CVE-2026-59843.htmlTue, 01 Sep 2026 21:18:34 +0000MEDIUM 6.5: A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.https://patchthecve.com/cve/CVE-2026-59842.htmlhttps://patchthecve.com/cve/CVE-2026-59842.htmlTue, 22 Sep 2026 19:47:55 +0000LOW 3.7: A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amountshttps://patchthecve.com/cve/CVE-2026-15370.htmlhttps://patchthecve.com/cve/CVE-2026-15370.htmlTue, 22 Sep 2026 19:47:33 +0000MEDIUM 6.7: A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to